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T. TntrfKhictirm 


This report suimarizes the results of research supported by NASA Langley 
Research Center under Gr 2 mt NSG-11J2, Full details of these research efforts 
have been reported in references [1-6 ] , and in this report we will overview 
the results, conclusions, and suggestions. The personnel involved in this 
project have been 

Thesis students 

Ramon Bueno 

Edward Chow 

Electronic Systems Laboratory Research Staff 

Keh-Ping Dunn 

Stanley Gershwin 

M.I.T. Faculty 

Alan Willsky (principal investigator) 

In addition to the results described in the following sections, this 
project has benefited from interactions with several other research pro- 
jects. Specifically, the generalized likelihood ratio (GLR) technique has 
been applied with great success to the detection of arrhythmias in electro- 
cardiograms (7-11] , and a study has just been initiated to apply the GLR 
technique to the detection of traffic incidents on freeways. Also, we have 
interacted quite closely with the research effort being performed under NASA 
Langley Contract WSl-13914, which has been aimed at developing a dual- redundant 
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sensor failure detection system to be flight tested on the F8 aircraft 
(see [12-141), This effort has completed our research effort, which has been 
aimed at a fundamental, analytical examination of one method for failure 
detection in dynamic systems. 

The Generalized Likelihood Ratio (GLR) technique is a scheme for detec- 
ting euid identifying abrupt chauiges in dynamic systems. It attenpts to 
extract all available information about possible abrupt changes in a system. 
Because it is based on some of the key properties of Kalman filtering, it 
requires a model of the system being examined. This model allows the GLR 
technique to make use of the existing analytical redundancy in the system 
rather than requiring the installation of redundant hardware such as sensors 
to facilitate fault detection and con?>ensation. 

The GLR technique monitors the output of the Kalman filter. If the 
output is behaving as expected — i,e,, if the filter model accurately 
predicts the state of the system — no failure is declared. But if the 
filter output differs systematically from its predicted behavior a failure 
is declared and the output is examined closely to determine the time, type, 
and extent of the failure. 

The advantages of GLR include: 

1. It can reduce the requirements for multiple redundancy by taking maximal 
advantage of built-in functional relationships. 

2, GLR explicitly searches for the time that the failure occurred, thus 
allowing it to be sensitive to new data and consequently improving the 
chances for fast system recovery following detection of a failure. 
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3. Considerable analysis has been done on GLR behavior. We have found 
that it is analytically tractable and thus is amenable to detailed design 
tradeoff studies. 

4. A wide range of implementations are available. "Pull" GLR looks for 
any possible failure (of a finite set of types) ; constrained GLR (CGLR) 
looks only in certain set of directions j and sinplified GLR (SGLR) looks 
for a certain discrete set of failures. By restricting our attention as in 
constrained or simplified GLR, we can sometimes improve performance (if 
only certain directions or values are physically possible) and always re- 
duce the on-line computational load. In addition, sinplified GLR is even 
more analytically tractable than the others. 

The goals of our work have been; (1) to develop the analytic tools 
used to study GLR performeuice; (2) to test the aUaility of GLR to distinguish 
among different failure modes; and (3) to study the sensitivity of GLR to 
modeling and parameter errors. We have chosen to study these problems in a 
setting that tests the fundamental limitations of GLR, Specifically, we 
have applied GLR to the detection of a variety of abrupt changes in a simpli- 
fied model of the F8 aircraft. In our formulation, we have assumed no hard- 
ware redundancy, and hence all failure detection must be solely based on 
functional redundancy. This clearly accentuates the problems of failure mode 
distinguishability and GLR sensitivity, but we feel that this approach has 
yielded a great deal of insight into the characteristics and limitations of 
GLR. 
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As mentioned above, a simplified model of the F-8 aircraft has been used 
as a test bed for our studies. We have used a two dimensional model of the 
aircraft flying at condition 11, i.e. Mach .6, 20,000 ft., in cumulus clouds. 
This model is given by 

x(k+l) = 4>(k)x(k) + B(k)u(k) + w(k) (1) 

z(k) = H(k)x{k) + J(k)u(k) + v(k) (2) 

T 

with X = (q,ot) and q=pitch rate, a=eungle of attack. Here, u(k) represents 
a known control sequence, and w and v are independent zero mean gaussian 
sequences with covariances Q and R respectively. The Kalman filter is given 
by 

^(k+l|k) = 4>(k)$(klk) + B(k)u{k) (3) 

x(k|k) = x(k|k-l) + K(k)Y(k) (4) 

Y(k) = z(k) - H(k)x(k|k-1) - J(k)u(k) (5) 

where x(i|j) is the estimate of x(i) given the measurements z(l) ,... ,z( j) , 

K(k) is the filter gain, and Y(k) is the residual (innovations process) of 
the filter, which is a white noise process with covariance V(k) , The model 
and Kalman filter parameters appear in Table 1 (here the time step for 
discretization is 1/32 sec.). 

To repeat, in the work reported here, a worst case was considered in 
that no hardware redundancy was assumed (i.e. we have assumed only one 
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actuator and sensor of each type). Also# note that B has been left unspe- 
cified and was actually taken to be zero, since deterministic inputs do not 
affect the residuals. 

In Section II, we review and survey the GLR technique. In Section III, 
we focus on the issues of detectability and distinguishability. Questions 
addressed here include t assuming that the system is known perfectly, can we 
detect that a failure has taken place, can we deduce when it happened, and 
can we decide which of a restrict. d class of failures actually occurred? 

We briefly survey analytic and simulation results and conclude that detecta- 
bility and distinguishedsility, like controllability and observedsility, depend 
on the structure of the system, but can be studied off-line. In Section IV, 
we examine the sensitivity of the GLR technique to modeling errors. We find, 
by simulation, that the technique is indeed sensitive to such errors, but 
analysis and simulation show that the sensitivity is in certain characteristic 
ways, and so compensators may be designed for these difficulties. 

II. The Generalized Likelihood Ratio Techniques 

The Generalized Likelihood Ratio technique is designed to detect the onset 
of abrupt changes in linear systems. Devices based on this method determine 
simultaneously whether a change has taken place, the time that the change 
occurred, and an estimate of the extent of the change. In the air-craft problem 
the abrv.pt changes considered corresponded to certain types of system failures. 
Thus we will refer to all changes as "failures", although their true physical 
significance could be quite different (as with an abrupt wind shear). 

Four failure modes have been studied intensively: 

) 
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Table 1 


System and Filter Parameteis 


<D 


0,93258 -0.14649 

0.030587 0.97193 



0.022596 

0.0043276 


0.0 

0.00022603 




0.008729834 

0.0 


0.0 

0.06 


H 


1.0 

0.0 


0.0 

16.154 


J = 0 


K(k) = K = 


7.5351 X lO"^ 4.6257 x lo"^ 


1.3527 X 10 


-1 


1.2748 X 10 


-2 


cov(x(klk-l) ) m ^(kjk-1) 


V(k) = V = 


5.6311 X 10 
1.0891 X 10 
.-4 


-4 




1.0891 X 10 
2.2130 X 10 

-3 


-4 


-5 


6.393264579 x 10 1.759328799 x 10 


1.759328799 x 10 9,374701305 x 10 


-3 
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Tyt>o 1 ; state jump 

x(k+l) « *t>(k)x(k) + B(k)u(k) + w(k> + v6 « (6) 

k+1,6 

Type 2 ; state step 

x(k+l) - ^(k)x(k) + B(k)u(k) + w(k) + 0 (7) 

Type 3 ; sensor jump 

z(k) = H(k)x(k) + J(k)u(k) + v{k) + v6^ ^ (8) 

Type 4 ; sensor step 

z(k) = H(k)x(k) + J(k)u(k) + v(k) + ^ (9) 

where <5^^ ^ is the Kronecker delta, and g is the unit step, which is 1 

for k^fi and 0 for k<0. Here 0 has the meaning of the "failure time" and 
V is the failure vector of appropriate dimension. We note that the ori- 
ginal GLR method devised by Willsky and Jones [15] was developed for type 

1 failures. 

Other failure types can also be defined as modifications to (1), (2). 
For exanple, adding M u(k)cjj^^j^ g or 0 ^ defines the hard-over 

state or increased state noise failures (^ere M is an appropriate matrix 
and 5(k) is a zero mean random process). Similarly adding 



to (2) defines the hardover sensor or increased 


lLx(k)+Nu(k) Q or 0 

sensor noise failures. Detectors for these failures have not been studied in 
detail, although in many czises detectors looking for steps and jumps could be 
used Co detect such changes^ 

Assume that the Kalman filter (3), (4), (5) has been implen«nted to estimate 
the state of the unfailed system (1),(2). When one of the four types of 
failure occurs, equation (5) produces a residual which is no longer white. 

In fact. 


Y(k) «= Y(k) + G^(k;0)v (10) 

where Y is the residual in the absence of any failure, and (k;6) — the 
failure signature matrix ~ determines the effect of the ype i failure v 
th>it occurred at time 6 on the residual at time k. We can establish a set 
of hypotheses: 

: no failure has occxirred 

H. : a failure of type i (v and 9 unknown) has occurred, 

1 

Then the generalized I-* 'elihood ratio (GLR) is defined by 

p(Y(l) » | h. , 0 ■ 0(k), V » v(k)) 

L. (k) » i (11) 

^ P(Y(1) »...fY(J«) |Kq) 


5k>me work on developing GliR for these hard-over models has been done and 
is discussed in (11, 
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A A 

where p denotes probability density function; 6(k) and v(k) are the maximum 
likelihood estimates (MLE) of V and 6 assuming to be true. 

Given is true, the residual is given by (10) for some unknown 9 and 
V. v^en is true, the residual is simply y(k). 

To choose between and we use the decision rule: 

Hi 

Jl. (k) - 2iii(L, (k))> e (12) 

1 i < 

"o 

where e is some predetermined threshold. Ilie estimate v(k) can be solved as 
an explicit function of §(k): 

V(k) = ci^(k;6(k)) di(k;§(k)) (13) 

where Ci(k;B) is the matrix 

k 

Ci(k;6) = ^ Gi"^(m;6)V ^(m)Gi(m;6) (14) 

m»0 

and d. (k>§) is a linear combination of the residuals: 

1 

k 

d. (k;6; «s y G/^(ro»0)V ^(m)Y(m) (15) 

1 i 

mpO 

Then 0(k) is the value of 9 ^ k that maximizes £.i(k;0): 


/ 


10 


« d7(k»0)c^^(k,0)d. (k»0) 


(ife) 


A 

Therefore, the (full) GLR system will declare a type i f..ilure V occurring 
at 6 if lAkfh> e and Ji^(k;§)^ )l^(k;e) for 1 < 6 £ k and j-1,2,3,4. As 

time proqressv’s, the number of possible values of § increases. Hence, the 
implementation of this scheme involves a growing bank of filters to imple- 
ment (15) for each 9. 

A number of simplifications of the approach have been suggested by 

A 

wiilsky and Jones [15] such as thr . i Ite window assumption where 6 is res- 

A 

tricted to a range, k-M £ 9 £ k-N, fhe physical assumptions made here are: 

1) no decision can be made with less than N observations {an otservability 
constraint), 2) failures before time k-M should have been detected at an 
earlier time and compensated for already. The resulting "sliding window" 
reduces the conroutational burden imposed by the growing bank of filters. 

When the system under consideration is time invariant and the associated 
Kalman-Bucy filter (KBF) has reached a steady state, the G and C matrices 
become dependent on k-9 only. Thus, these matrices m^y be conputed once arid 
stored, greatly simplifying the regoirreo calculations. To reduce required 
calculations even further, G and C cam be approximated by polynomials, or a 
sequence of ramp and step functions. Also, (15) may be viewed as a convolution 
(it a correlation calculation, as in a matched filter) and may then be 
calculated very rapidly using the Fast Fourier Transform, 

Another simplification is constrained GLR (CGLR) which involves the 
assumption that v = af^ where a is a scalar and f^ is one of a finite set 
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or directions. The CCI.R detector (for a sinqle fai^yro tyiio) takes the 
form: 


a(k;6(k), j(k)) 


where 6(k) and J(k) are the quantities that maximize 


(17) 


?.(k; 0, j) 


b^<k; 0>_i) 
a(k; 0, j) 


( 10 ) 


a(k; c*, j? = f1C(k;0)f. , b(kj 


(19) 


iL(k;0(k) , 


H. 

1 


j(k) 


( 20 ) 


Clearly we can use CGT.R when ue have several failure types. 

If V is further restricted to be some constant Vq# one has simplified 
GLR (SGLR) . We note that SGLR does not require maximization over V and 
hence £(1;^) becomes 


k 

£{k;0) [2y(m) - G(m;0)VQ] »v’’^{m)G{m;0) (21) 

m=l 

/s 

Here we simply choose 0(k) to maximize (21) and declare a failure if 
^■(k;9) is over a threshold. Note that (21) is linear in Y and therefore 


)l(k;6) is a gaussian random variable. This makes SGLR more amenable to 
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analysis than full or constrained GLR, 

Both CGLR and SGLR require less computation than full GLR, They are 

directionalized, i*e,, most sensitive to certain directions. This can be 

of qreat practical value where only certain kinds of failures are physically 

meaningful. Such knowledge can greatly decrease sensitivity problems and 

can vastly improve our cibility to distinguish among tlic various failure types. 

It is clear that the GLR method offers a range of implementations from 

the point of view of computational complexity. In order to develop a useful 

detector design methodology, one must study much more carefully the properties 

of the GLR method and the tradeoffs inv Oved in the design. Our research has 

intended to provide some guidelines for the use of the GLR technique. Our aim 
provided some guidelines for the use of the GLR technique. Our aim has 

been to develop a framework in which one can systematically study the various 

tradeoffs that arise in detecting failures by this approach. 

III. Detectability and Distinguishability 

Tn this section, we discuss certain characteristics of GLR when the 
system parameters - except for the failure terms - are known perfectly. 

Here, the major issues are detectability (can the system find that a failure 
has occurred without great risk of false alarms, and without great delay?) 
and distinguishability (can the system properly identify the type of failure, 
the failure vectors, and (perhaps) the failure time?) . 

A. Performance Probabilities 

The probability of correct detection (Pj^) is the probability that 
is above the threshold e at time k if a failure of type i (with failure 
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vector V) occurred at. time 0 < k. The probability of false alarm (P^) is 

the probability that JL^(k;9) is above E when no failure actually occurred. 

The cumulative distribution function is the probability that the detec- 

tion time (i.e, the first time k>0 that i. (k;6)>e when we have a type i 
— 1 

failure at time 0 with vector v) k is less than a given time T, The proba- 
bility of choosing the wrong time is the probability of S,^(k,9) being 
above the threshold when the failure actually occurred at 0^ 0, The cross 

detection probability P^^^ is the probability of being above the threshold 
when the failure was actually of type j^i, P^^, is the probability that both 
these events have taken place, and is the wrong time-cross detection proba- 
bility. 


p^(k,i,0,v) = Prob (£^(k;0)> e[h^,0,v) 

Pjj,(k,i,0) = Prob (i^(k;0)> e|Hq) 

P (T,i,0,v) = Prob (Jl. (kj9)> e for some 
TD 1 

0 < k < TjfP ,0,v) 

P^^(k,i ,0t»v,9) = Prob (8.^(kj0)> e|h^,0^,V) 
PcD^k,i, j,0,V) = Prob (£,^(k,0)> e1h^,0,V) 

P (k,i,j,0,0 ,v) = Prob (£. (k,9)> eIh., 0 ,v) 


( 22 ) 


( 23 ) 


( 24 ) 


( 25 ) 

( 26 ) 


( 27 ) 



To calcvilate these probabilities, we closely examine the GLR equations. 

2 

It can be shown [3] that is a noncentral X random variab'e with n 

degrees of freedom^ when the true failure is of type j, magnitude V, time 0^. 
The non-centrality parameter is given by 


6^ = vV’|'j(kf0|0^)c"|^(kfe|e)c^j^(k»e|e^)v 

where 


C, 

1 


^(kf0|0^) 


I 


m=max(0,0^) 


GT(m;0)V ^(m)G.(m|6 ) 

1 3 t 


(28) 


(29) 


Note that the expected value of S,(k;0) is n+6 , 

2 

Figure 1 shows 6 as a function of k-0 where e=14 (so P =.000912) , 

r 

T T 

V =(.022o,0) in the curves marked q, and v =(0,. 00043 ^ in the curves marked 

a. These curves are for state step failures in the F-8 model described in 

2 2 

Section I, Figure 2 plots <52/2^^'®^ wrong time and correct 

and (wrong time) cross detection. Here a state step failure with vector 
( .00226 ,0) occurred at 0=k-3O. 

This plot displays some of the cross detection and wrong time difficulties 

2 2 

that may arise. Note that 6 ._(k,0)> 6 . (k,0 ) (i.e. , the wrong detector is 

4/2 

more likely to trigger than the correct one) for all 0 except the correct 

2 

failure time. Furthermore, the curvature of very shallow near 

0=k-3O. Thus, the system may have great difficulty in choosing the correct 0. 


The dimension of V is n. 
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2 2 

Figure 3 displays »g) for various values of 6 and Pp(e) as func- 

tions of c, the threshold. Note that these curves depend only on the non- 
2 

central X distribution with 2 degrees of freedom and not at all on any other 

information about the system or its failures. All other such information is 
2 

summarized in 5 , Note that for a given P »e is determined, and that among 

F 

2 

Pp, and 5 , any two determine the third. In general, to increase the 

f2 

spread between P„ and , o must be inwreased. 

F D 

B. The Information Matrix 

The C matrices are indicators of sensitivity and distinguishability of 
failures in the GLR technique. In particular, the inverse of 
C^(k;6) = C^j^(k;9t9) is equal to the covaraince of the estimate V(k) 

(assuming we correctly determine 9) , Under conditions of correct detection 
at the correct time, 

6^ = (k;9)V (30) 

Thus C indicates directions (in failure space) of greater or lesser sensitivity 

to failures, euid thus gives us a measure of signal-to-noise ratio. The 
2 

greater 6 , the larger the meam of £.(k,9) amd the greater the likelihood of 
exceeding the tJireshold, 

Note that (13) requires the inversion of C^(k;6), If this matrix is not 
invertible, failures in some 'direction cannot be detected. Thus, the requirement 
for universal detectability is that C is invertible. This condition is analogous 
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to observability in linear systems and can be verified in advance. We note 
that sensor failures are always observable, while the observability of dy- 
namics failures is directly related to the observability of the original 
system [3] , 

Equation (28), in general, shows how errors of failure type or failure 
time affect the detector. If C, i .(k}6l6)v is large for some V, then the 
system is li)tely to erroneously declare a failure type i at time 9, when, 
in fact, a failure of type j occurred at time 9^. 


From (29), y c^j^(k;9|9)M can be thought of as an inner product between 

G^(*;9)y and G^(»;9^)v, i.e, the inner product of the signature of a type i 
failure at time 9 and a type j failure at time 9^, When this is large, the 
failures are likely to be nearly indistinguishcible , but when they an. nearly 
orthogonal, we expect no difficulty in distinguishing between these failure 
modes. We note that the analysis for CGLR is quite similar, but in that case 
the directions y and V are restricted to fixed finite sets (although their 
magnitudes are free) . The analysis for SGLR is even simpler. 


C. Behavior of the Log Likelihood Ratios 

One reason that analysis of GLR performance is nontrivial is that the log 

2 

likelihood ratios, in full or constrained GLR, are noncentral x remdom 

variables. However, in simplified GLR, Jl^(k;9) is given by (21) and is a 

qaussian random variable. The mean of il^(k;9) and the covariance of 

(k ,9 ) and J,. (k ,9 ) can be easily calculated [6]. 

X X X X M ^ 
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These quantities are important because the probabilities calculated in 
Section II. A are all static (except for the distribution in the they 

consider the probability of £(k,G)>e for a given k and 0. By considering ^ 
as a (correlated) random process, we can calculate the probability of events 
such as {)Uk,0)>e, k=kj^, . . . ,k 2 K Thus we can create more sophisticated detec- 
tion rules which look at sequences of ratios euid which cam decrease the false 
alarm rate, cross detection difficulties, etc. (See also the sensitivity pro- 
blem discussed in the next section) . 

D. Simulation Experience 

Numerous computer simulations have been performed using the F-8 model 
described in Section I. It was found that for any of the four failure types 
described in Section II, detection occurs within two seconds if the failure 
size is on the order of the standard deviation of the noise. Thus detectad>i- 
lity is not a problem, 

Distinguishadiility, however, can lead to difficulties. Figure 4 shows 
a plot of J.(k,9) for a simulation run in which a step failure in the state 
occurred (type 2), The detector was based on that failure. Figure 5 shows a 
plot of 2.(k,0) from a run in which a step failure in the q-sensor (type 4) 
occurred but where the detector was looking for a step failure in the state 
(type 2). Notice how similar these plots are. This implies that it would be 
very difficult to distinguish between these failures by looking at l^(k,6). 

The reason for this is that full GLR allows the estimate v(k) to be any 

A A 

point in space. In this case V_,_(k) and V„ ,.(>.; have been found such that 

2/2 
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Fig. 4 Likelihood Ratio: q-state step 
failure; state step detector 




Fiq. 5 Likelihood Ratio: q-sensor 
step failure: state step detector 
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1^2 (k, 6) - “ 02(k)C2(k;e|e^)V2(k) 

and 

* 2 / 4 *’''®’ ■ V4'>‘'C2/4<'‘'e|etic‘J/4Oc.e|e^)C2^,(k.e|e^)0j^,(K) 

take on approximately equal values for all k,6. 

There are two ways out of this difficulty. One is to use constrained 
or simplified GLR. It is likely that the wrong estimate^ v (k) in this 
case, is not physically n»aningful. If we had restricted our attention only 
to meaningful failure directions and, perhaps, magnitudes, much ambiguity 
would have been eliminated. Another point to note is that the wrong estima- 
tes of V and 0 are likely to change much more v/ith k than the correct esti- 
mates, and t 4-s can help In choosing the correct failure type. Research in- 
vestigating performance improvements using these ideas is continuing. 

Finally, it should be noted that the magnituue of the state failure that 
leads to Figure 4 is on the same order as the noise in the dynamics. However, 
to get Figure 5 with likelihood ratios approximately the same as in Figure 4 
requires a q-sensor failure on the order of more than 10 times the magnitude 
of the noise in the sensor. Hence, if we used a threshold to detect step fai- 
lures of (say) lOcT, it would take a lOOo q-sensor failure to confuse us. 

Issues such as this, involving notions of signal to noise ratios, can be ana- 
lyzed by detailed examination of the , together with knowledge concerning 

reasonable expected magnitudes for the various failure modes. 

It should be pointed out that we have demonstrated a particularly nasty 
example. Figure 6 displays £.(k,6) for a run in which a step failure in the 



-24- 


iK-ficnnor (ty|H> 4) took p3.aco, and whom tho detector, aqain, was deniqned for 
a step failure in the state (type 2). The marked difference between Figure 6 
and Figure 4 indicates that while there may be distinguishability difficulties 
between state step and q-sensor step failures, there are no such difficulties 
between state step and a-sensor step failures in the F-8 (if one can utilize 
the full information in H(k,0) as a function of both k and 6). 

E. Conclusions 

Using a coirbination of analytic and simulation approaches, the GLR tech- 
nique has been extensively studied under the assumption that the system is 
perfectly modeled. The four failure types investigated are satisfactorily 
detectable but can lead to problems in distinguishability. The key issues in 
this problem have been isolated. Further research should resolve this dif- 
ficulty. 

IV, sensitivity to Modeling Errors 

In designing GLR failure detectors, it is necessary to hypothesize a 
certain unfailed system (1) , (2) , In this section, we exaunine the behavior 
of this technique when the model parameters used in calculating the Kalman 
filter gains and the detector matrices C^(k,6), G^(k,6) do not correspond 
with those of the true system. Not surprisingly, performance is somewhat 
degraded. However, in view of the large modeling errors assumed, and in the 
manner in which performance is affected, there is hope that such errors can 
be compensated for. In any event, one can use these results to determine 
the size of failures that can be detected. That is, if we view these 
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mode linq errors as unavoidable, we may decide to set detector thresholds 
higher to avoid false alarms. This in turn increases the magnitude of 
each failure type that is needed to achieve a given probability of detection, 

A, Description of Mismatch 

In the mismatches we consider, the true system is the simplified model 
of the longitudinal dynamics of the F-8 at either flight condition 10 or 12, 
i.e,, at Mach .4 or ,8, 20,000ft,, with cumulus clouds. The system on which 
the Kalman filter and detector were based was at condition 11, i.e, Mach ,6 
with the same altitude and weather conditions. These systems differ in two 
important ways. Although in all systems the sensor H matrix is diagonal, 
the term, which depends on the dynamic pressure, changes by a factor of 
2 from condition 10 to 11 and again from 11 to 12, In addition, while the 
aircraft oscillatesunder all three conditions, its period drops sharply from 
condition 10 to 11 *hd from 11 to 12, 

These changes affect the behavior of the quantities of interest in the 
GLR technique: Y# 2-# However, they affect them in very specific ways, 

and by studying this, some compensation is possible. 

B. Behavior of GLR Random Variable 

Because the Kalman filter no longer matches the system, it is no longer 
true that the unfailed residuals form a white noise process. However, it can 
easily be shown that Y(k) is the output of a process which oscillates with the 
same period as that of t?.e true system, i.e, flight condition 10 or 12 here. 
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Because Y(k) is oscillatory/ and because 8. is a quadratic function of 
Y, 8(k/6) is also oscillatory: both as a function of k for fixed 0 and as a 
function of 6 for fixed k. Figure 7 shows (i.e., the likelihood ratios 

of the full GLR state step detector) when the true system is at condition 12, 
and where no failure has taken place. The maximum value of i here is over 
1000, so that this will surely precipitate a false alarm. It should be poin- 
ted out that under mismatch conditions (but not under matched conditions) the 
value of the system vector is important. Here, at k=0, q=0 auid oi=5^, which 
is quite large. Under more quiescent conditions, the mismatch will be far 
less apparent. 

This shows that we cannot simply as if 2. is greater them a threshold, but 
we must look also at the behavior of 2. and other quantities. For instance, 
as long as the first peak of i is the highest 2. in the window (Figure 6), 9(k) 
will correspond to that peak. If the first peak leaves and the second peak 

A 

enters, then at some k there will be an abrupt shift in 6(k). This oscillatory 

A 

behavior of I and the shift in 6 are cheuracteristic of mismatches and are 

A 

important indicators. In addition, V(k), which may be time-varying as discussed 

A 

earlier, )iere juit^js abruptly with 6(k), 

Figures 8 and 9 show the behavior of 2,2(k,6) when a state step (type 2) 
failure and a sensor step (type 4) failure teike place. In both cases 2, is 
well over the threshold discussed in Section III, but the maximum value of 2 
in Figure 8 is slightly less than of Figure 6, while that in Figure 8 is 
nearly 4000, (However, it is not always tirue that the correct detector has 




Fig, 8 Likelihood Ratios Under Mismatch 
state step failure in q; state step detector 
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hiqher i!^(k,9) than the wrong detectors, especially under mismatch conditions). 

Thus we see that although the mismatch is severe, the detector for state 
steps yields a far larger likelihood ratio under failure conditions (Figure 8) 
than when here is no failure (Figure 7) , This indicates that by simply raising 
detector threshold, we Ccin minimize the effect of system mismatch. Of course, 
one would haope to utilize more information eibout the shape of the Jl(k,9) 
contours in these figures to do even more. This awaits further work, 

C. Compensation for Mismatch 

It was pointed out that one of the major effects of mismatch is the 
change in the which is related to dynamic pressure. We have considered 
the possibility that we may be able to measure dynamic pressure directly 
so thattwe can effectively correct the mismatch in the a sensor. In Figure 
10 J,(k,9) is displayed for a state step detector constructed in this way. 

The maximum value of J, is now only 25, Therefore, we can expect far 
fewer false alarms. Further studies are required to determine if this 
improves cross detection and mismatch performance. 

It would appear that some mismatch difficulties can be resolved by 
designing GLR to be operated in conjunction with an adaptive estimation con- 
trol system such as the multiple model method [16] , The latter would be res- 
ponsible for detecting shifts in parameters (possibly including hard-over 
failures), and the former would search for abrupt additive changes. 




Fig. 10 Likelihood Ratio Under Par- 
tially Compensated Mismatch: No failure; 
state step detector 
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V. Conclusions and Suggestions 

The Generalized Likelihood Ratio (GLR) method for failure detection 
has been intensively studied. Many of the basic issues such as detectability, 
distinquishcibility , and parameter sensitivity have been identified and 
analyzed. The P-8 model has proved to be a useful setting in which to for- 
mulate problems and test ideas. We have performed these tests under most 
severe conditions in order to determine the characteristics ind fundeunental 
of GLR. 

Our basic conclusions are that GLR is an extremely promising method 
for the detection of abrupt changes in dynamic systems. The method has 
been successfully applied in several applications [7-14] , it is amenable to 
detailed performance analysis, and it offers a range of implementations of 
varying levels of complexity. Failure mode distinguishability and pareuneter 
sensitivity do cause problems, as one might expect, but we have seen that one 
can analyze these issues in great detail. Specifically, the information matrix 
allows one to determine the absolute limits on one's ability to distinguish 
among several failure modes. In addition, we have seen that detector response 
in the presence of parameter errors differs markedly from the consistent 
response due to a failure. 

Issues that should be examined in the future include: 

(A) Failure Mode Distinguishadaility 

(1) The orthogonalization of failure modes in order to improve 
distinguishability should be considered. This includes the 
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possibility of a dual-mode procedure, in which one first 
detects failures with a "universal" signature and then 
uses orthogonal signatures to determine the actual failure 
mode. 

(2) The implementation and study of the performance of CGLR, 

(3) The study of the correlation behavior of the 

under various failure hypotheses in order to determine 
"smart" detection rules that make decisions based on 
patterns of likelihood ratios, 

(4) The study of other failure modes (hard-over, added noise, 
etc.). Can we find useful signatures (perhaps the same 
as for the basic four modes) to use in detecting these 
failures? What about combinations of failure modes 
(e.g., bias + hard-over, noise + bias, multiple failures)? 

GLR is general enough to deal with all of these. Our 

aim here is to define some useful groundrules for 
choosing an appropriate set of failure signatures 
(perhaps modulated by x or u, as in the hard-over cases) , 

(3) GLR Robustness — The results obtained so far indicate that parameter 
uncertainties can lead to difficulties in correctly detecting system 
failures. However, our results also indicate that such parameter uncer- 
tainties lead to very distinctive likelihood ratio patterns. Several 
issues must be considered. 
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(1) The statistics of the residuals in the presence of 
parameter errors are somevdiat complex but should be 
examined. 

(2) Parameter errors lead to residual signatures much like 
failures. These should be examined in order to under- 
stand how they can confuse GLR and how to avoid such 
confusion. 

(3) As mentioned in the preceding section, the likelihood 
ratio patterns when parameter errors are present have 
very distinctive forms. Thus we are interested in 
determining smart detection rules. One appealing as- 
pect of smart rules is the use of provisional decisions. 
That is, based on initial information we may make a 
decision to pull out a particular instrument or activate 
a back-up. We can then continue to monitor residuals 

to obtain corroboratory information concerning the failure 
(see [12-14] for an approach along these lines in a dual- 
redundant system) . In this way we avoid catastrophic 
delays when a large failure really is there. 

(4) It is felt that CGLR and SGLR will be less sensitive to 
parameter errors. This should be examined via simulation, 

(5) In many problems there are system nonlinearities, as well 
as parameter errors, that must be dealt with. One should 
exaunine modifications of GLR that can deal with this. 
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Kor I'Xiimfilf*, one can dovclop fixtended r,LH (I’(’.LR) , 
the analog of the extended Kalman filter. 

(6) Another important area that can be studied is the ef- 
fect of discrepancies in system state dimension. For 
example, if a GLR system is based on the 2-dimensional 
F-8 model, how well will it behave on a real F-8, 
which is much more complex? 

(C) Coniplexity and Performance — All of the results up to this point have 
been aimed at understanding the qualitative features of GLR and in developing 
a set of analytical tools. This inside and these techniques are essential 
to the development of a GLR design methodology. This methodology clearly 
must come to grips with a number of tradeoff issues: 

(1) We need to develop several measures of performance, such 
as delay time in detection, false alarm rate, etc. Such 
measures may be of more importance in some problems than 
in others — e.g. false alarms may be more tolerable in 
highly redundant systems. Also, one must develop methods 
of evaluating such measures. We have done that in some 
cases, but if we develop detection rules dealing with 
patterns of likelihood ratios, we will have to develop 
new analytical techniques. 

(2) In many cases -- e.g. when several identical sensors are 
available — one can use much simpler detection systems 
than GLR, such as voting. In addition, redundancy can 
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greatly reduce distinguishabllity and sensitivity 
problems. For example, GLR detectors looking for 
failures in identical Instruments would register 
similar responses to parameter errors, and this si- 
milarity could be exploited to avoid declaring a 
failure. The tradeoffs involved in determining what 
redundant design is most appropriate is a problem 
worthy of further study. 

Our research efforts have been extremely worth^diile in developing GLR 
and in extracting the key issues involved in implementing a GLR- based 
detection system. This method has been successfully applied in several 
applications, and it is our feeling that the GLR approach has the potential 
to be a useful design tool in future aerospace applications. 
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